Mal, Evie, Jay, and Carlos visit the Isle of the Lost to choose four new villain's kids (VKs) to take to Auradon. They pick Dizzy, daughter of Drizella and granddaughter of Lady Tremaine, Celia, daughter of Dr. Facilier, and Squeaky and Squirmy, the twin sons of Mr. Smee. The day the kids are to be picked up, Ben, Mal's boyfriend and the king of Auradon, proposes to her. She accepts; Ben's ex-girlfriend Audrey seethes with jealousy and her grandmother Queen Leah admonishes her for failing to secure the family legacy by marrying Ben.
When the barrier is opened for the new VKs, Hades, the god of the underworld, attempts to escape, but Mal beats him back in her dragon form. That night, unable to contain her jealousy of Mal, Audrey steals the Queen's Crown and Maleficent's Scepter from The Museum of Cultural History. The theft and Hades' escape attempt has the citizens panicking. Mal, as future Queen, decides the best way to protect the subjects and restore peace is to close the barrier permanently, meaning no new VKs can come, nor can anyone enter the Isle.
Audrey attacks Mal with Maleficent's scepter, turning her into an old hag. Mal and the other VKs go to the Isle to get Hades' ember, the only thing powerful enough to break the scepter's curse. Mal is restored upon entering the Isle due to the suppression of evil magic there. Celia gets Mal into Hades' lair, but he thwarts their effort to steal the ember. He is revealed to be Mal's absentee father and reluctantly gives her the ember, warning her that it mustn't get wet and will not exhibit its full powers for her. While leaving the Isle, Mal and the others are stopped by Uma, Gil, and Harry, who take the Ember; they agree to help after Mal agrees to release all the children from the Isle.
In Auradon, Audrey attacks Jane's birthday party with a sleeping curse; Chad obsequiously aligns himself with Audrey, while Jane escapes into the Enchanted Lake. As the entire kingdom falls under Audrey's spell, she offers to reverse it if Ben will marry her; he refuses, so she turns him into a beast and begins turning people to stone. Mal and Uma, vying for leadership of the VKs, return to Auradon with their friends. Despite their bickering, they defeat suits of armor animated by Audrey. Uma finds Audrey's diary and learns that she spends time at Fairy Cottage, a contribution for which Mal thanks her. Evie, nervous to define her feelings for Doug, wakes him with "true love's kiss." Carlos calms Ben, in beast form, until Jane restores him with lake water. As Mal and Uma are thawing towards each other, Audrey traps them in Evie's house; they reverse Audrey's spell by combining their magic, and they all reunite there.
At the Fairy Cottage, they find only a shell-shocked Chad. When Mal admits that she plans to seal off the Isle permanently, the group implodes and Celia, learning she can never see her father again, throws the ember in a birdbath, and Uma and Harry leave. After Evie tells Mal how upset she is for lying to her and their friends, they are all suddenly turned to stone, except for Mal. Audrey takes Celia hostage and attacks Mal, who turns into her dragon form. Realizing she is Mal's only hope, Uma combines their magic to reignite the ember; Mal overcomes Audrey, who falls comatose, and the curses are lifted. The ember could revive Audrey, but only in Hades' hands; Ben agrees to send for him, while Uma, Harry, Gil, and Celia plan to return to the Isle. Mal apologizes for lying; her friends and former rivals forgive her as they understood that she was just trying to do the right thing. Hades arrives and revives Audrey, but decries the double standard by which Audrey is immediately forgiven because she is not considered a villain. Mal and Ben apologize to Audrey; in response, Audrey and Queen Leah apologize to Mal.